Malicious code in wix-elementory-globals (npm)

The package wix-elementory-globals was found to contain malicious code...

MAL-2025-39368 Malicious code in wix-elementory-globals (npm)

The package wix-elementory-globals was found to contain malicious code...

PT-2026-50455

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.27 modelscan affected versions not specified Description A parsing logic error exists in the list globals function when processing STACK GLOBAL opcodes. The scanner fails to track arguments in the correct range...

Malicious code in globals-package (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95530b4f6700a81e9563fcc03525cb458953b3bfee2504f42e1cd50558a64dcb Any computer that has this package installed or running should be considered...

MAL-2025-5411 Malicious code in globals-package (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95530b4f6700a81e9563fcc03525cb458953b3bfee2504f42e1cd50558a64dcb Any computer that has this package installed or running should be considered...

CVE-2006-4525

Cross-site scripting XSS vulnerability in CubeCart 3.0.12 and earlier, when registerglobals is enabled, allows remote attackers to inject arbitrary web script or HTML via the links array...

GHSA-4P4H-9GVQ-7XFG Duplicate Advisory: Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-93mv-x874-956g. This link is maintained to preserve external references. Original Description The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.getservercertificate can...

Duplicate Advisory: Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-93mv-x874-956g. This link is maintained to preserve external references. Original Description The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.getservercertificate can...

PYSEC-2025-34

The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.getservercertificate can exfiltrate data via DNS after deserialization...

PYSEC-2025-34

The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.getservercertificate can exfiltrate data via DNS after deserialization...

CVE-2025-46417

The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.getservercertificate can exfiltrate data via DNS after deserialization...

CVE-2025-46417

The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.getservercertificate can exfiltrate data via DNS after deserialization...

CVE-2025-46417

The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.getservercertificate can exfiltrate data via DNS after deserialization...

CVE-2025-46417

CVE-2025-46417 affects Picklescan up to version 0.0.25, where unsafe globals exclude ssl, allowing ssl.get_server_certificate to exfiltrate data via DNS after deserialization. Exploitation details are not provided in the connected documents. CVSS vectors indicate high impact under NVD (7.5) and m...

Picklescan missing detection when calling built-in python library function timeit.timeit()

Summary Using timeit.timeit function, which is a built-in python library function to execute remote pickle file. Details Pickle’s deserialization process is known to allow execution of function via reduce method. While Picklescan is meant to detect such exploits, this attack evades detection by...

PT-2025-17680 · Unknown · Picklescan

Name of the Vulnerable Software and Affected Versions: Picklescan version 0.0.24 and earlier Description: The issue arises from the unsafe globals in Picklescan not including ssl, allowing ssl.get server certificate to exfiltrate data via DNS after deserialization. Recommendations: For Picklescan...

Remote Code Execution

Picklescan is vulnerable to Remote Code Execution. The vulnerability is due to improper restriction of dangerous globals, allowing an attacker to craft a malicious model that executes pip.main to install and execute malicious packages...

Porch-Pirate - The Most Comprehensive Postman Recon / OSINT Client And Framework That Facilitates The Automated Discovery And Exploitation Of API Endpoints And Secrets Committed To Workspaces, Collections, Requests, Users And Teams

Porch Pirate started as a tool to quickly uncover Postman secrets, and has slowly begun to evolve into a multi-purpose reconaissance / OSINT framework for Postman. While existing tools are great proof of concepts, they only attempt to identify very specific keywords as "secrets", and in very...

CLSA-2024-1706700142 php: Fix of 8 CVEs

CVE-2021-21702: Fix null pointer crash because of malformed SOAP server response - CVE-2021-21703: Fix error in php fpm shared memory organization leading to privilage escalation - CVE-2022-31625: Fix freeing of uninitialized memory leading to RCE - CVE-2022-31626: Fix buffer overflow in mysqlnd...

Porch-Pirate - The Most Comprehensive Postman Recon / OSINT Client And Framework That Facilitates The Automated Discovery And Exploitation Of API Endpoints And Secrets Committed To Workspaces, Collections, Requests, Users And Teams

Porch Pirate started as a tool to quickly uncover Postman secrets, and has slowly begun to evolve into a multi-purpose reconaissance / OSINT framework for Postman. While existing tools are great proof of concepts, they only attempt to identify very specific keywords as "secrets", and in very...